Looks like some Windows Server 2016 events are not parsing correctly - there may be more that aren't parsing that may not be enabled on our servers. These events are all related to group enumeration which would be great events to collect.
Hoping Andy can channel this through internal channels
Solved! Go to Solution.